risk based thinking flows through iso ... - quality digest · risk based thinking flows through iso...

RISK BASED THINKING

FLOWS THROUGH

ISO 9001:2015

DRIVING A FASTER,

BETTER ORGANIZATION.

Presented by

Peter Merrill

www.questmgt.com

Q U E S T

2

STRUCTURAL CHANGESHigh Level Structure (All ISO Mgt Systems)

• QMS, EMS, IT security etc.

• standard core text and structure

Inclusion of services

Organizational context

Fewer prescribed requirements

No Automatic Exclusions

Management Review moved to ‘Monitoring’

3

Risk-based thinking

• replaces preventive action

‘Documented information’

• replaces ‘documents and records’

‘External provision

• Replaces ‘Purchasing and Outsourcing’

Increased ‘Leadership’ requirements

Management representative

• Title removed

CONTENT CHANGES

4

ISO 9001:2008 FLOW

5. Management Responsibility

• 5.1 Management Commitment

• 5.2 Customer Focus

• 5.3 Quality Policy

• 5.4 Planning

• 5.5 Responsibility, Authority

and Communication

• 5.6 Management Review

6. Resources

Management

• 6.1 Provision of

Resources

• 6.2 Human Resources

• 6.3 Infrastructure

• 6.4 Work Environment

7. Service Realization

• 7.1 Planning of service

Realization

• 7.2 Customer Related

Processes

• 7.3 Design and Development

• 7.4 Purchasing

• 7.5 Service Operations

• 7.6 Control of Monitoring

and Measuring Devices

8. Measurement,

Analysis and

Improvement

• 8.1 General (Planning)

• 8.2 Monitoring and

Measurement

• 8.3 Control of Non

Conforming service

• 8.4 Analysis of Data

• 8.5 Improvement

5

ISO 9001:2015 STRUCTURE

5 Mgt Responsibility

5 Leadership5.1 Leadership commitment

5.2 Quality policy

5.3 Roles, responsibilities

6 Planning6.1 Risks and opportunities

6.2 Planning to achieve objectives

6.3 Planning of changes

6 Resources Mgt

7 Support7.1 Resources

7.2 Competence

7.3 Awareness

7.4 Communication

7.5 Documented information

7 Product Realization

8 Operations8.1 Planning and control

8.2 Product and service reqts

8.3 Design and development

8.4 External provision

8.5 Production/service provision

8.6 Release of product/service

8.7 Control Nonconforming Output

8 Meas’m’t Analysis Imp’t

9 Perfomance Evaluation9.1 Meas’m’t analysis evaluation

9.2 Internal audit

9.3 Management review

10 Improvement10.1 General

10.2 Nonconformity + C/A

10.3 Continual improvement

Plan

Do Check

Act

4 Context of the Organization

6

SYSTEM THINKING

A System is ‘A Set of inter-related and interacting elements

A Management System is a Network of People , Process and

Technology

7

4 CONTEXT OF THE ORGANIZATION

4.1 The organization and its context

• Strategic issues

4.2 Needs/Expectations interested parties

• Not just customers

4.3 Scope of the QMS

• Define Boundaries - Exclusions

4.4 QMS and its processes

• As 9001:2008 §4.1

8

4.1 CONTEXT ISSUES FOR EXTERNAL

RISK

Context Issues (Examples) Impact

(1-5)

Probability

(1-5)

Detectability

(1-5)

Impact x

Probability ÷Detectability

Technology

Exchange rate

Competition

Market

Economy/Oil Price

Legislation

Vendors

Labour Market

etc. etc.

9

PROCESS MAP FOR INTERNAL

RISK POINTS Process

Owner

Customer

Underwriter

Operations Manager

Operations Planner

Consultant

Requests

Service

Agree Req'ts

Design & Specify

Pilot Test

Plan Survey

Select Subcontractor

Prepare Survey

Assemble Survey

Prepare Report

Deliver Report

etc.

10

SOME CAUSES OF INTERNAL RISK

Low Competency

Frequent Change of Persons

Task Performed Infrequently

Complex Process

Old Equipment (i.e. Failure) or

Unclear Customer Requirements?

11

5 LEADERSHIP

5.1 Leadership and commitment

• Accountability, awareness, engagement

5.2 Quality policy

• similar to 9001:2008. + ‘applied’

5.3 Roles, responsibilities and authorities

• QMS Reporting (Mgt Rep title removed)

12

6 PLANNING FOR THE QMS

6.1 Address risks and opportunities

• QMS ability to achieve intent, mitigate risk.

6.2 Objectives + planning to achieve them

• Measurable, link to policy, updated

• Resources to meet objectives, evaluate

results

6.3 Planning of changes

• Purpose of change

• Resource and responsibility

13

6.1 CONTROLLING AREAS OF RISK

ProcessSupplier

Product &

Communication

Customer

Product &

Communication

Procedures1 2 543

Competence & Technology

ISO 9001:2015 requires processes are controlled (See 8.5.1)

14

6.2 CASCADE OF OBJECTIVES

Policy 5.2

Planning 6.2

Awareness 7.3

15

PLANNING TO ACHIEVE OBJECTIVES (6.2.2)

Objective What is to be

done

Resources

needed

Who is

responsible

When it will be

done

How results

will be

evaluated

16

7 SUPPORT

7.1 Resources

7.2 Competence

7.3 Awareness

7.4 Communication

7.5 Documents

17

7 SUPPORT; 7.1 RESOURCES

7.1.1 General • Resource constraints, external resources

7.1.2 People • Provide necessary persons

7.1.3 Infrastructure • Information and communication technology

7.1.4 Environment for operating processes • As 9001:2008 §6.4

7.1.5 Monitoring and measuring resources • Calibration.

7.1.6 Organizational knowledge • Knowledge acquisition and management

1818

7.1.6 ORGANIZATIONAL KNOWLEDGE

determine knowledge for process operation

maintain knowledge, make it available.

address changing needs and trends,

how to acquire additional knowledge.

consider;

internal sources

• learning from failure and success,

• experts within the organization

external sources

• standards, academia, conferences,

• customers or providers

1919

7.2 COMPETENCE Competence;

The ability to apply knowledge to achieve intended results

determine the necessary competence of person(s)

take actions to acquire competence,

evaluate the effectiveness of actions taken:

actions can include,

• training, mentoring, hiring competent persons.

retain documented evidence of competence.

20

7.5 DOCUMENTS

7.5.1 General

The extent of documents for a QMS can differ due to:

▪ organization size, process complexity, competence.

7.5.2 Creating and updating

Ensure identification, review and approval.

7.5.3 Control of documents

▪ ensure availability, confidentiality

▪ address distribution, access, storage and preservation,

▪ legibility; control of changes and disposition.

Documents of external origin shall be controlled.

21

Document

MaintainDocumentedInformation

Record

RetainDocumentedInformation

NEW WORDING – FOCUS ON INFORMATION

22

DOCUMENTATION REQUIREMENTS

ISO 9001:2015 requires

‘documented information’ to be maintained;

• Defining boundaries and applicability of QMS (see 4.3)

• Defining the scope of the QMS (see 4.3)

• Justifying any requirement not applicable (see 4.3)

Organization decides

which supporting information to document;

• Supporting the operation of the organizations processes (See 4.4.2).

• Necessary for the effectiveness of the QMS. (see 7.5.1)

• Describing the interaction between the processes (See 4.4.1)

demonstrate that processes are controlled (See 8.5.1).

23

8 OPERATION CLAUSES (ISO9001:2008 §7)

8.1 Operational planning and control

8.2 Requirements for products + services

8.3 Design and development

8.4 Externally provided products and services

8.5 Production and service provision

8.6 Release of products and services

8.7 Control of nonconformity

2424

9 PERFORMANCE EVALUATION

CLAUSES

9.1 Monitoring, measurement, analysis, evaluation • 9.1.1 General

• 9.1.2 Customer satisfaction

• 9.1.3 Analysis and evaluation

9.2 Internal audit

9.3 Management review

25

FEED RESULTS TO MANAGEMENT REVIEW

Exec

Summary

Management Review

Problems or Projects

for Action with

Resources Agreed

Utilize Resources

Follow-up

Internal Audit

Monitors C/A

26

10 IMPROVEMENT

10.1 General

• Similar to 9001:2008 §8.5.1

10.2 Nonconformity and corrective action

• Similar to 9001:2008 §8.5.2

• Addition of complaints

10.3 Continual improvement

• Link to analysis, evaluation, management review

• Address underperformance

27

THE IMPROVEMENT CYCLE

Internal audit

(9.2)

Improvement (10.1)

Management

Review (9.3)

(Allocate

Resources)

7.1)

Executive Summary

(5.3)

Process and Service

Monitoring (9.1)

Customer

Feedback

(9.1.2)

28

ISO 9001:2015 CERTIFICATION

TRANSITION TIMELINE

September 2015 start of 3 years transition period to September 2018

2018201720162015

September 2015

Published International Standard

29

ISO 9001:2015 Implementation Timetable

Phase One: Management Planning

Gap Analysis

Leadership Workshop

Strategic Plan

Measurement Plan

Support Reqts

Phase Two: Quality System Development

Manual Development

Employee Awareness

Service Issues

Procedure Revisions

Corrective Action

Customer Satisfaction

Phase Three: System Assessment

Internal Audit Training

Selection of Registrar

Internal Audit

Refine Procedures

Prelim. Assessment

System Adjustment

Main Audit

Registration Confirmed

30

THANK YOU

Questions?

Presented by

Peter Merrill

www.questmgt.comQ U E S T